Is there a public PoC exploit available for CVE-2026-11516?

Yes, a public proof-of-concept exploit is available for CVE-2026-11516. Prioritise patching immediately. EPSS: 0.0%.

UTT HiPER 2610G CVE-2026-11516

Q: What is the CVSS score of CVE-2026-11516?

CVE-2026-11516 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35066 LOW

Classic Buffer Overflow (CWE-120)

2026-06-08 VulDB

GHSA-x96m-rwwr-fr23

Buffer Overflow Hiper 2610G Utt

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 15:37 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 15:37 NVD

5.5 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jun 08, 2026 - 14:54 vuln.today

DescriptionCVE.org

A vulnerability was found in UTT HiPER 2610G up to 3.0.0-171107. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBinds results in buffer overflow. The exploit has been made public and could be used.

AnalysisAI

Buffer overflow in UTT HiPER 2610G firmware (up to 3.0.0-171107) enables an authenticated, adjacent-network attacker to corrupt memory via an unsafe strcpy call in the web management NAT static mapping form handler. By supplying an oversized NatBinds argument to /goform/formNatStaticMap, an attacker can achieve low-level impacts across confidentiality, integrity, and availability on the targeted device. No KEV listing is present, but a public proof-of-concept is confirmed on GitHub, materially lowering the exploitation barrier for any attacker already on the local network.

Technical ContextAI

The root cause is CWE-120 (Classic Buffer Overflow) - a direct consequence of using strcpy without input length validation before copying user-supplied CGI parameter data into a fixed-size stack or heap buffer. The affected code path is in the /goform/formNatStaticMap handler, which processes NAT static mapping configurations submitted via the device's embedded web management interface. UTT HiPER 2610G is a network gateway and router product; its web forms are standard CGI-style handlers typical of embedded Linux firmware. CPE cpe:2.3:a:utt:hiper_2610g:*:*:*:*:*:*:*:* confirms all enumerated firmware revisions up to and including 3.0.0-171107 carry the vulnerable code. The CVSS temporal metric E:P (Proof of Concept) aligns with the publicly hosted exploit code on GitHub.

RemediationAI

No vendor-released patch has been identified at time of analysis - the RL:X (remediation level unknown) temporal metric and absence of any UTT advisory confirm this gap. As the primary compensating control, administrators should immediately restrict access to the device's web management interface using ACLs or upstream firewall rules, allowing only trusted management hosts to reach the HTTP/HTTPS management port. Disabling or restricting the NAT static mapping feature through device configuration would eliminate the specific attack surface at /goform/formNatStaticMap, though this disables the associated NAT functionality and must be weighed against operational requirements. Placing the management interface on a dedicated, isolated management VLAN reduces the adjacency attack surface (AV:A) by limiting who can reach the device at layer 2. Enforcing strong, unique credentials mitigates the PR:L prerequisite, raising the bar for attackers seeking an authenticated session. Monitor VulDB at https://vuldb.com/vuln/369136 and the UTT product page for firmware patch releases.